Uh oh!
There was an error while loading. Please reload this page.
release-train: staging -> main - #174
Merged
Merged
Conversation
…end#1552) (#153) e2e-test-agent#13 added the .github/workflows directory this repo had lacked since it was created on 2026-06-03, so nine `exempt` entries now assert the opposite of reality — `exempt` means the caller must be ABSENT, and all nine are present. Left alone, the next scheduled caller-drift run goes red for a gap that has just been closed. This was the largest single-repo block of UNREMEDIATED exemptions in the file: 11 of the 21 org-wide, where the next worst repo has 3. The harm they recorded was not hypothetical — no issue or PR in the repo had ever reached the board, which is why e2e-test-agent#11 sat open and unreviewed for seven days. Flipped to the private-train-repo template, identical to frontend-app: seven required callers, public-pii-gate exempt (private repo), wip-limit-check exempt (retired org-wide), both copies required. RFC-BACKEND-1405 D1 always required this — "Exempt never means ungoverned: every repo keeps branch protection, the code-quality caller and kanban auto-add" — so this is compliance catching up, not a change of policy. release_train stays FALSE. caller-drift.py:562 verifies that field against release-train/repos.yml, so flipping it before the repos.yml entry lands would fail the guard. RFC-BACKEND-1552 D2 amends D1 to enrol the repo; the flip to true follows the repos.yml entry. The *no_workflows_directory_at_all anchor stays — devex-bootstrap still uses it. Verified: `python3 scripts/caller-drift.py --inventory repo-inventory.yml --source-dir .` exits 0, "No drift. Every repo read, every entry matched." across all 20 repos. Epic: tracebloc/backend#1552 RFC: tracebloc/rfcs#12 Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
release-train: develop -> staging
release-train: develop -> staging
Pin every actions/* ref to the full 40-char commit SHA it currently resolves to, with a trailing exact-version comment (D10, RFC-BACKEND-1405). Behaviour-preserving: no version changes, only removal of silent tag mutation. tracebloc/* refs stay on @main by design; third-party refs were pinned under backend#1490. Part of tracebloc/backend#1491. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…91 sweep lands (backend#1492, D10) (#159) * sec(code-quality): whole-tree action-pin gate, advisory until the #1491 sweep lands (backend#1492, D10) Hand-pinning does not hold (#1446/#1449: a second unpinned call site of the SAME action merged cleanly while the pin PR was open). New default-on action-pins job: strict line grammar, comment-safe, whole-tree always; tracebloc/*@main allowed by Q3, 40-hex pins by D10, digest-pinned docker://, local ./ actions; expression refs are refused, not skipped (property 2). action-pins-soft-fail defaults true (format-soft-fail's migration shape) so armed repos do not redden before #1491 merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(action-pins): judge tracebloc/* before SHA_PIN; build the expression marker from parts (Bugbot + actionlint, #159) A tracebloc ref frozen on a SHA is drift, not a pin - the owner check must come first. And actionlint validates expressions inside run: blocks, so the Python source must never contain a literal expression opener even in a string. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(action-pins): zero files scanned is a malfunction, not a pass; summary carries the full finding list (Bugbot round 2, #159) Any caller repo has at least one workflow (its own caller), so an empty glob means the checkout/cwd is wrong - fails even under soft-fail, which governs findings, never scan integrity. And the ten-annotation cap made a backlog repo show ten warnings and a bare count - the summary now lists every finding like the sibling jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… On dev card (backend#1437) (#157) * fix(router): sibling-based merges get a visible label, not a stranded On dev card (backend#1437) The '*' fallthrough routed any merged PR with a non-integration base to On dev, where it stranded forever — the parent PR carries the content onward and nothing ever moves the sibling's card again (6 cards in the 2026-08-02 audit). Now: no column move, sibling-merge label instead, so the condition is visible to the weekly board pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): sibling merges route to On dev WITH the label; writes hard-fail; reconcile mirrors the rule (Bugbot, #157) All three findings real: (1) a skipped Status write let the project's built-in Item-closed automation Cancel shipped-via-parent work - On dev + label is the non-terminal holding state; (2) || echo swallowed label write failures against the PROJECTS_KANBAN_TOKEN write rule - they fail the step now; (3) kanban-reconcile's membership add re-stranded siblings missed by auto-add - it now applies the identical rule + label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): sibling merges route to On dev WITH the label; writes hard-fail; reconcile mirrors the rule (Bugbot, #157) All three findings real: (1) a skipped Status write let the project's built-in Item-closed automation Cancel shipped-via-parent work - On dev + label is the non-terminal holding state; (2) || echo swallowed label write failures against the PROJECTS_KANBAN_TOKEN write rule - they fail the step now; (3) kanban-reconcile's membership add re-stranded siblings missed by auto-add - it now applies the identical rule + label. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): status before label; dry runs never mutate (Bugbot round 2, #157) Label-before-status let a label failure skip the column write via the implicit success() condition, stranding the card in the built-in automation's Cancelled - exactly what round 1 fixed. Order flipped in both files. Reconcile's label write moves inside the wet path: dry runs classify (SIB flag) but mutate nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(router+reconcile): status before label; dry runs never mutate (Bugbot round 2, #157) Label-before-status let a label failure skip the column write via the implicit success() condition, stranding the card in the built-in automation's Cancelled - exactly what round 1 fixed. Order flipped in both files. Reconcile's label write moves inside the wet path: dry runs classify (SIB flag) but mutate nothing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(reconcile): reset the sibling flag per ITEM, not per merged-PR branch (Bugbot round 3, #157) SIB=0 lived inside the merged-PR else-branch, so an issue or open PR visited after a sibling inherited the flag and got mislabeled. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
release-train: develop -> staging
LukasWodka
commented
Aug 6, 2026
ContributorAuthor
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit d402c36. Configure here.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-mainbranch (a mirror ofstaging), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Medium Risk
Touches org-wide reusable workflows and kanban automation (PAT label writes, status columns); mistakes could mis-route cards or block CI, but changes follow existing fail-closed patterns and default soft-fail for pin findings.
Overview
This promotion bundles org CI supply-chain and kanban fixes in
tracebloc/.github.Action pinning (D10): Several shared workflows now use commit-SHA
uses:refs (actions/checkout,setup-python,add-to-project,actions/stale) instead of floating version tags.code-quality: Adds anaction-pinsjob (on by default, soft-fail by default) that scans all workflow files for unpinned third-party refs, with rules fortracebloc/*@main, SHA pins, and unverifiable expression refs.Kanban (backend#1437):
kanban-closure-routertreats merges into non-develop/staging/mainbases as sibling merges: On dev status plus asibling-mergelabel (after status update).kanban-reconcilemirrors that usingbaseRefName, resets per-item sibling flags, and applies the same label on wet adds.repo-inventory.yml:e2e-test-agentcaller/copy exemptions flip torequiredafter workflows landed; public-pii-gate commentary notes the fail-closed unarmed gate is now on main.Reviewed by Cursor Bugbot for commit d402c36. Bugbot is set up for automated code reviews on this repo. Configure here.